Remote Code Execution (RCE)

2022-01-1707:54:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

49.8%

JSON

October CMS is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the input via the theme import function allowing an attacker with access to the backend to execute maliciously crafted PHP code.

CPENameOperatorVersion
october/systemlev1.0.472
october/systemlev1.1.5
october/octoberlev1.0.472
october/octoberlev1.1.5
october/cmslev1.0.472
october/cmslev1.1.5
october/systemlev1.0.472
october/systemlev1.1.5
october/octoberlev1.0.472
october/octoberlev1.1.5

Name	Operator	Version
october/system	le	v1.0.472
october/system	le	v1.1.5
october/october	le	v1.0.472
october/october	le	v1.1.5
october/cms	le	v1.0.472
october/cms	le	v1.1.5
october/system	le	v1.0.472
october/system	le	v1.1.5
october/october	le	v1.0.472
october/october	le	v1.1.5